Ecosystem · WordPress

Your WordPress sites and your repositories, in the same dashboard.

LibWatch inventories the core, plugins, themes and PHP version of each site, and alerts you when a vulnerability affects them. No plugin to install.

Monitor a site How to connect
Read with an AI .md version

Client sites · 18 sites

Example · this morning, 7:02 a.m.

  • Martin Bakery

    WordPress 6.8.1 · PHP 8.1

    PHP at end of life

  • Duval & Associates

    contact-form-7 5.9.0

    Medium severity

  • Summer Festival

    An abandoned plugin

    Unmaintained

  • Western Mutual

    WordPress 6.8.3 · PHP 8.4

    Up to date

Rechecked every night at 2 a.m.

Connection

A site connected in two minutes

WordPress already supports it: no plugin, no file to upload to the server.

Create a dedicated user

Administrator role: it's the only one that can list plugins through the REST API. A separate account can be revoked without affecting the others.

Generate an application password

Profile › Application Passwords, name it “LibWatch”. WordPress shows it only once.

Paste the site URL and the password into LibWatch

The first analysis starts right away. To cut off access, revoke the password in the profile.

What LibWatch checks

Everything running on the site

Core

WordPress version

Compared with published vulnerabilities and the latest release.

Plugins

Every plugin, active or not

A deactivated plugin is still an exploitable file on the server.

Themes

Active theme and installed themes

Child themes and forgotten themes included.

PHP

The site's PHP version

When the site shows it: end of life and engine vulnerabilities, like PHP2Shell.

Health

Abandoned plugins

Removed from the official directory or not updated in years.

Every night

Nightly watch

PHP version rechecked every night; plugins and themes at each analysis, which can be scheduled.

Sources

Where the vulnerabilities come from

LibWatch doesn't make up its own alerts: it cross-checks recognized public databases.

CVE Program

Vulnerabilities published with a CVE ID

The global reference database, for core, plugins and themes.

Wordfence Intelligence

The WordPress-specific feed

Added on top, when enabled, to cover plugins faster.

CERT-FR

French government alerts on PHP

For vulnerabilities in the PHP engine that runs your sites.

LibWatch and your security plugin

The two work together

A security plugin protects a site from the inside. LibWatch monitors all your sites from the outside.

On each site

Security plugin

  • — Web application firewall and attack blocking.
  • — Scan of the site's files.
  • — Installed and updated site by site.
Across all your sites

LibWatch

  • — Inventory and vulnerabilities of all your sites in one place.
  • — Your Git repositories in the same plan.
  • — Nothing to install on the sites.

Frequently asked questions

LibWatch and WordPress

Why an administrator account?

The WordPress REST API only lists plugins to users who can manage them. Use a dedicated account, which you can revoke at any time.

Is multisite supported?

Each site is added by its URL, with its own application password. In a multisite network, add the sites you want to track one by one: each counts as one project.

What if the site hides its PHP version?

The rest of the analysis is unchanged: core, plugins and themes are checked. PHP end of life and engine vulnerabilities are only reported if the site reveals its version.

Does a site count as a project?

Yes. A WordPress site counts as one project in your plan, like a Git repository.

Your WordPress sites, checked from the first analysis.

A site counts as one project, like a Git repository.

Monitor a site
Hosted in France by OVHcloud